Codemender

**Name of the Vulnerable Software and Affected Versions** Angular Language Service VS Code Extension versions prior to 21.2.4 **Description** The client-side extension configures the tooltip Markdown renderer with the `isTrusted: true` option, causing VS Code to trust all rendered content and enable active elements like command URIs. The background Angular Language Server process fails to escape or sanitize brackets, raw links, and control characters from JSDoc strings before forwarding hover Markdown content. An attacker can exploit this by creating a TypeScript or JavaScript file, or a third-party npm package, containing a malicious JSDoc tooltip with an embedded active command link. If a developer hovers over the symbol and clicks the link, the IDE executes the command sequence on the host machine. **Recommendations** Update to version 21.2.4.

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.15 Angular versions prior to 20.3.22 Angular versions prior to 19.2.23 **Description** A Denial of Service (DoS) issue exists in the `@angular/common` package. The `formatNumber()` function, also used by `DecimalPipe`, `PercentPipe`, and `CurrencyPipe`, fails to validate the upper bounds of the `digitsInfo` parameter. When a maliciously crafted `digitsInfo` string containing excessively large fraction digit values is processed, the internal `roundNumber()` function attempts to pad the digits array to match the requested size, causing an unbounded loop. This leads to resource exhaustion: in Server-Side Rendering (SSR) environments, it can crash the Node.js server process due to a JavaScript heap out of memory error; in Client-Side Rendering (CSR), it blocks the main thread and freezes the browser tab. Exploitation requires the application to use these formatting utilities with a `digitsInfo` parameter controlled by untrusted user input. **Recommendations** Update to version 22.0.0-rc.2. Update to version 21.2.15. Update to version 20.3.22. Update to version 19.2.23. As a temporary workaround, avoid passing untrusted user input directly into the `digitsInfo` parameter of the `formatNumber()` function or the affected pipes.

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 **Description** An information disclosure issue exists in the `@angular/service-worker` package. When the Service Worker fetches assets, it preserves metadata from the original request. During cross-origin redirects, the Service Worker fails to strip sensitive headers, which violates the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials, such as `Authorization` tokens, `Proxy-Authorization` credentials, or session cookies, by triggering a cross-origin redirect to an untrusted external origin. **Recommendations** Update to version 22.0.1 Update to version 21.2.17 Update to version 20.3.25